[SOLVED] Block encrypted compressed files and not encrypted PDF

Stoiko Ivanov

Proxmox Staff Member
Staff member
May 2, 2018
6,968
1,080
164
Hello guys,

is it possible to block just encrypted compressed and not encrypted PDF?
Lots of viruses come from ZIP files with password, not from PDFs.
Thanks in advance.
Without trying it out - it seems that clamav (which is used to detect encrypted documents/archives) seems to have two options (from `man clamd.conf`):

AlertEncrypted BOOL
Alert on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf).
Default: no

AlertEncryptedArchive BOOL
Alert on encrypted archives (encrypted .zip, .7zip, .rar).
Default: no

AlertEncryptedDoc BOOL
Alert on encrypted documents (encrypted .pdf).
Default: no

you could try replacing AlertEncrypted with AlertEncryptedArchive in the clamd.conf.in template:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_template_engine

please share if this worked for you :)
 
Sep 18, 2019
82
6
13
Italy
www.abzsol.com
Without trying it out - it seems that clamav (which is used to detect encrypted documents/archives) seems to have two options (from `man clamd.conf`):



you could try replacing AlertEncrypted with AlertEncryptedArchive in the clamd.conf.in template:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_template_engine

please share if this worked for you :)
Hello @Stoiko Ivanov
sorry but I don't get what I've to try/do :)
Could you give me more infos please?

Thanks!
 

Stoiko Ivanov

Proxmox Staff Member
Staff member
May 2, 2018
6,968
1,080
164
sorry but I don't get what I've to try/do
as written in the docs I linked:
* create /etc/pmg/templates
* copy /var/lib/pmg/templates/clamd.conf.in to /etc/pmg/templates

change:
Code:
[% IF pmg.clamav.archiveblockencrypted %]                                                           
AlertEncrypted true                                                                                 
[% ELSE %]                                                                                          
AlertEncrypted false                                                                                
[% END %]
to
Code:
AlertEncryptedArchive true

* run pmgconfig sync -restart 1
* check the journal that clamd has restarted

test with an encrypted pdf (and an encrypted zip)
 
  • Like
Reactions: hata_ph

Stoiko Ivanov

Proxmox Staff Member
Staff member
May 2, 2018
6,968
1,080
164
Thanks for reporting back! - this will certainly help others with a similar problem to solve :)
 
  • Like
Reactions: abzsol

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!